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A STATISTICAL LOADS STUDY OF S-IC CONTROL 
ENGINE-OUT CONDITIONS ON THE APOLLO SATURN V VEHICLE 

By May T. Meadows 

SUMMARY 


A statistical loads study that was used to evaluate the adequacy 
of the spacecraft structure for one Saturn IC control engine-out con- 
ditions on the Apollo-Satum V vehicle is presented. The spacecraft 
was not designed for these conditions. The Monte Carlo approach is 
used to obtain the probability distribution for the maximum bending 
moment at the command module/service module interface, which is the 
most critical structural location. The results of the study show that 
the command module/service module interface has a factor of safety of 
1.2 for a L. 2-sigma loading condition. Because this is considered an 
adequate factor of safety for such a low-probability loading condition, 
the existing Apollo spacecraft structure is Judged acceptable for 
Saturn IC control engine-out conditions . 


INTRODUCTION 


Engine-out failure conditions were not considered in the original 
design of the Apollo spacecraft. Later calculations showed that 
"worse-on-worse" engine-out loads significantly exceeded the capability 
of the Apollo command module /service module (CM/SM) interface structure. 
Extensive modifications would have been required to allow the structure 
to withstand these worst-case loads. However, because the occurrence 
of such worst-case load conditions appeared to be considerably remote, 
it was first considered desirable to evaluate the probability of their 
occurrence. The results could then be used to establish the extent 
of any structural redesign. Therefore, it is the intent of this paper 
to determine a rational set of loads for the Saturn IC (S-IC) control 
engine-out conditions and, thereby, assess the adequacy of the existing 
Apollo spacecraft structure. 
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DISCUSSION 


An S-IC engine shutdovm can be caused by a slow mechanical failure, 
an electrical failure, or an explosive failure. In the case of a slow 
mechaniceil failure, a safe shutdown occurs when the Thrust OK Pressure 
Switch (tops) senses a pressure loss in the chamber. The TOPS cuts off 
the engine only after it drops to a preset pressure level, which is 
about 80 percent of a full thrusting engine. The probability of such 
an event is O.OOOUU (ref. l). Although a TOPS-type shutdown is con- 
sidered a safe type of failure, it could produce large loads. 

An electrical failure in any of the engine components results in 
an engine decaying from its full thrust value and, therefore, has a 
greater decay rate than the TOPS shutdown. However, this type of 
failure has a probability of only 0.000005 (ref. l). 

CatJistrophic failure of propulsion system components can occur, 
with resulting loads grossly exceeding spacecraft capability. This 
type of failure has a probability of O.OOOO 6 I (ref. l), which is 
approximately seven times less likely them the TOPS shutdown. 

Since the TOPS-type shutdown is by far the most probable way an 
engine will shutdown emd because the other failure modes are very 
unlikely to occur, only the TOPS-type shutdowns are considered in this 
study. 

The determination of vehicle loads dut to an engine-out on a 
launch vehicle during boost is complicated by the numerous time- 
varying parameters involved. For exeunple, the time history of thrust 
for the failed engine depends on a number of factors such as rate of 
thrust decay, type of shutdown, and time of failure. Also, because 
wind profiles have a large daily variance, any parametric study com- 
bining wind response and loss of thrust of one outboard engine would 
entail extensive ceJ.culations . 

The manner in which these parameters are combined is important. 
Discrete cases could be calculated based on Judgement from the entire 
remge of possible input parameters. However, there would be no proba- 
bility level associated with the loads, and experience may well be in- 
sufficient in selecting these discrete cases. 

A Monte Carlo statistical analysis provides a method of obtaining 
the loads associated with a given probability level. This is a m'^thod 
of calculating loads based on values chosen randomly from the various 
parameters represented by seme type of probability distribution so that 
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completely random cases are generated for calculating the loads. These 
loads are analyzed satistically to obtain a probability of occurrence 
corresponding to each load. 


ANALYSIS 


The initial S-IC engine-out calculations were based on the engine 
decaying from its full thrust level with a maximum thrust-decay rate. 

At the same time, the peak wind magnitudes (both shear and direction) 
wore imposed on the vehicle. This worse-on-worse failure condition 
resulted in excessively high loads. The probability of all these 
extreme conditions occurring simultaneously is extremely low, but no 
logical method of combining these parameters could be performed until 
sufficient information on the performance of the thrust decay was avail- 
able. Results of recent static engine tests conducted by Marshall 
Space Flight Center (ref. 2) now provide statistical data on the shut- 
down of an S-IC engine. 

Because the loads resulting from an engine shutdown vary considerably 
according to the combinations of thrust level cut-off, thrust decay 
rate, flight time, and wind magnitude euid direction, some method cf 
combining these parameters ij needed for a conclusive study, llie Monte 
Carlo approach, in which the input data are selected at random either 
from direct measurements or from statistical distribution, was used in 
this study. A random number generator digital program was used to make 
the selection from the specified distributions. All parameters were 
assumed to be statistically independent. The parameters with their 
associated distribution are as follows: 

1. Thrust OK pressure cut-off level. (Static tests show this to 
have a normal (Gaussian) distribution.) 

2. Thrust decay rate of cut-off engine. (Static tests show this 
to have a normal distribution. ) 

3. Time of engine loss. (A uniform distribution was used since 
the engine failure could occur at any time from lift-off until separa- 
tion. ) 

U. Position of failed engine. (A uniform distribution was used 
since any of the four control engines is equally likely to fail. ) 

5. Wind profile. (A uniform distribution was used for the quarter 
of the year with the highest winds.) 
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The wind profiles were selected from dally samples measured at 
Cape Kennedy during the first 3 months of I 966 and I 967 , which provided 
sufficient data for performing a Monte Carlo type of analysis. The most 
severe winds occur during the first quarter of the year. The daily 
wind profiles were considered to constitute a uniform distribution and, 
thus, were considered equally likely to occur. The •'omplete wind pro- 
• file for each sample was used in a loads digital computer program, FALL, 

which computes the lateral loads during flight. The program has time- 
varying coefficients for the complete boost trajectory and includes 
the structural dynamic characteristics, linear and nonlinear aerody- 
namics, and the launch vehicle control system. Trajectory data for the 
Apollo 9 mission were used in this study and were obtained from ref- 
erence 3 . Output consisted of the vehicle responses and loads as a 
function of time for all vehicle stations, including the most critical 
structural location, the CM/SM interface. 

Winds at Cape Kennedy are predominately from the west during the 
high-wind months and could increase or decrease the loads depending on 
which one of the four control engines fails. Figure 1 shows the loca- 
tion of the four control engines in the standard Apollo coordinate 
system. With the number U engine out, a weat wind could increase the 
loads, but the same wind would tend to decrease the loads with the 
number 2 engine out. 


CALCULATIONS 


Random values of the input parameters, which were considered 
mutually independent, were generated by the computer program Random 
Input Generator (RIG) for 300 cases. For a 3-sigraa confidence limit, 
these 300 cases are sufficient to predict a load which will not he 
exceeded 97 percent of the time. These results ar • presented in 
figure 2 and show that the maximum bending moment will not exceed 

I 1 . 2 L X 10^ in. -lb 97 percent of the time (for the most critical location, 
the CM/SM interface). In a static structureil test, this interface was 

tested to 5*0 x 10 ^ in. -lb before failure. 

The probability of losing one S-IC control engine that would be 
sensed by the TOPS is O.OOOUI 4 . Thus, the probability of having a load 

greater than U.2U x 10 ^ in. -lb due to a TOPS engine failure for a launch 
during the first 3 months is O.OOOUU x 0.03 = 0.000013. The CM/SM inter- 
face bending moment versus probability is presented on figure 3. 
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CONCLUDING REMARKS 


The Apollo spacecraft was not designed for Saturn-IC engine-out 
conditions. This study assesses the adequacy of the existing structure 
for these conditions. The most probable way a Saturn-IC engine will 
lose thrust is by a slow faiixu*e that would be sensed by the Thrush 

OK Pressure Switch. A Monte Carlo analysis of Thrust OK Pressure Switch 

shutdowns shows that the probability of having a bending moment greater 

than U.2U x lo^ in. -lb at the command module/service module interface is 

0.000013 or U.2 sigma. This interface was tested to 5.0 x lo^ in. -lb 

before it failed. Thus, the existing Apollo spacecraft structure has 
approximately a 1.2 factor of safety for a U. 2-sigma loading condition, 
which is considered an adequate factor of safety for such a low- 
probability loading condition. Therefore, the existing Apollo space- 
craft structure is Judged adequate for the one Saturn-IC control 
engine-out conditions. 
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Figure 1.- Saturn IC engine layout showing relation of 
control engines to wind direction. 
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Figure 2.- Percent probability that a bending moment will tot be exceeded if 
S-IC control engine has failed (CM/SM interface). 



S-IC control engine (CM/SM interfewre). 



